Using email address as OpenID identifier

Paul E. Jones paulej at packetizer.com
Wed Apr 2 16:14:07 UTC 2008


Joseph,

 

That argument was given to me yesterday, but I don't think you really need
to worry with your DNS provider unless you're also trying to operate your
own OP.

 

Suppose, for example, you have an ID assigned by myopenid.com.  I don't know
what URI format they'll use, but let's say it is
https://myopenid.com/joseph.  Or, perhaps it's https://joseph.myopenid.com.
Whatever the format, there is always a user component to it.  So, it would
be quite simply to take the user component and put it into an e-mail ID
style like joseph at myopenid.com.  This does not necessarily mean you have an
e-mail address, but it could be an e-mail address.

 

The conversion from that form to a URI form is easily achieved via NAPTR
records similar to the one I show below.  So, before any XRDS query is
performed, the RP would see if the ID provided is an e-mail-style ID.  If
so, query for the NAPTR record and then perform the conversion from the
e-mail-style to a URL.  From there, it all works the same.  It's just a
"make it simple" enhancement that requires no changes to the core Open ID
specs.

 

Paul

 

From: Joseph Holsten [mailto:josephholsten at gmail.com] On Behalf Of Joseph
Anthony Pasquale Holsten
Sent: Wednesday, April 02, 2008 4:52 AM
To: Paul E. Jones
Cc: specs at openid.net
Subject: Re: Using email address as OpenID identifier

 

Does anyone have the time to write an email -> xrds discovery spec so we can
formally ignore it? And so people can argue with their dns providers instead
of on list?

 

http:// Joseph Holsten .com

 

 

On 02008:04:01, at 9:30CDT, Paul E. Jones wrote:





Folks,

 

I've seen discussion here and there on the use of the e-mail address as the
OpenID identifier.  Perhaps this one says it best:

http://www.majordojo.com/2007/02/what-openid-needs.php

 

I share many of same opinions.  If OpenID is going to be practically usable
by the average person, we cannot require the person to remember some very
complex identifier.  When I signed up for Yahoo's OpenID service, it
presented me with a hideously ugly URL that looked similar to a
base64-encoded string.  I could not begin to tell you what it was.
Fortunately, Yahoo allowed me to define my own, friendlier name.  Still, the
ID is not one that the average user will remember or get right.

 

While the e-mail address does not have to be the one's ID, it can certainly
serve as an alias.  Suppose, for example, that the DNS records at Yahoo
contained the following entry:

 

  yahoo.com. IN NAPTR 100 10 "U" "OpenID2"
"^(.+)@(.*)$!https://me.yahoo.com/\1!i <https://me.yahoo.com/1!i> "

 

This would allow a Relaying Party to accept an e-mail address and perform a
simple transformation to get the "real" URL identifier.  Of course, this
does not mean that the existing URL or XRI identifiers are invalid, nor does
it mean that the "email address" has to be a real e-mail address.  But, this
form would certainly be far simpler for most people to deal use.

 

If something like this has been discussed and rejected, what was the reason?

 

Thanks,

Paul

 

_______________________________________________

specs mailing list

specs at openid.net

http://openid.net/mailman/listinfo/specs

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs/attachments/20080402/bcb9ea81/attachment-0001.htm>


More information about the specs mailing list